HIPAA Policy

A. HIPAA NOTICE OF PRIVACY PRACTICES

Sara Technology, Inc.
Last Updated: December 15, 2025

IMPORTANT NOTICE REGARDING ACCEPTANCE

By creating an account, accessing, or using the Sara Technology platform in a professional or institutional capacity, you acknowledge that you have read, understood, and agree to be legally bound by this HIPAA Notice of Privacy Practices and the incorporated Business Associate Agreement. If you do not agree, you may not create an account or use the platform.

1. Scope of This Notice

This Notice of Privacy Practices ("Notice") describes how Protected Health Information ("PHI") may be used and disclosed by Sara Technology, Inc. ("Sara," "we," "us") when Sara acts as a Business Associate under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), as amended, and its implementing regulations, including 45 C.F.R. Parts 160 and 164.

This Notice applies only to users who access Sara in a professional, clinical, or institutional capacity, including but not limited to Speech-Language Pathologists, clinics, hospitals, private practices, healthcare providers, schools acting as healthcare providers, or other entities qualifying as Covered Entities under HIPAA ("Covered Entities").

Sara is a technology platform provider and is not a healthcare provider, does not practice medicine or speech-language pathology, and does not provide medical advice, diagnosis, or treatment.

2. Our Role Under HIPAA

When used by a Covered Entity, Sara acts solely and exclusively as a Business Associate, processing PHI on behalf of the Covered Entity and only as permitted by:

This Notice
The Business Associate Agreement ("BAA") incorporated herein
The Sara Terms of Service
Applicable federal and state privacy laws

The Covered Entity retains sole responsibility for determining whether and how Sara is used in clinical or therapeutic workflows and for ensuring compliance with HIPAA, including obtaining all required patient, parent, or guardian authorizations and consents.

3. Representations by Covered Entities (SLPs)

By creating an account or using Sara in a professional capacity, you represent, warrant, and agree that:

You qualify as a Covered Entity or authorized workforce member under HIPAA
You have obtained all legally required consents, authorizations, and permissions to input PHI into the Sara platform
You will not submit PHI unless legally permitted to do so
You will use the platform only for lawful healthcare or educational purposes

Sara relies on these representations in providing its services.

4. Protected Health Information We May Process

When authorized by a Covered Entity, Sara may receive, store, process, or transmit PHI, including but not limited to:

Child first name, initials, or unique identifier
Birth month and year
Speech articulation performance, therapy targets, and progress data
Audio recordings of speech practice sessions
Therapy-related usage, engagement, and interaction metrics
Metadata associated with therapy activities

Sara does not require Social Security numbers, full birthdates, or financial information to provide services.

5. Permitted Uses and Disclosures of PHI

Sara may use and disclose PHI only for the following purposes, as permitted under HIPAA:

a. Platform Services
To operate, host, maintain, support, secure, and provide the Sara platform and its features as instructed by the Covered Entity.

b. Product Development and Improvement
To analyze PHI that has been de-identified in accordance with 45 C.F.R. §164.514, or aggregated such that it no longer identifies an individual, for purposes of improving system performance, speech-analysis algorithms, machine-learning models, and platform functionality.

c. Security, Integrity, and Compliance
To detect, prevent, and respond to security incidents, fraud, misuse, or violations of law, and to comply with applicable legal obligations.

d. Subcontractors and Service Providers
To engage third-party service providers that perform services on Sara's behalf, provided that such providers are bound by written agreements requiring HIPAA-compliant safeguards and confidentiality protections.

Sara does not sell PHI, use PHI for targeted advertising, or disclose PHI for unrelated commercial purposes.

6. Safeguards

Sara implements and maintains reasonable and appropriate administrative, technical, and physical safeguards designed to protect the confidentiality, integrity, and availability of PHI, including but not limited to:

Encryption of PHI in transit and at rest
Role-based access controls and least-privilege principles
Secure cloud infrastructure and access monitoring
Audit logging and incident detection mechanisms

No system is completely secure, and Sara does not guarantee absolute security.

7. Individual Rights and Requests

All individual rights related to PHI, including rights of access, amendment, restriction, accounting of disclosures, or deletion, must be exercised through the Covered Entity.

Sara will cooperate with Covered Entities to the extent required by law in fulfilling valid requests but does not respond directly to individual requests unless legally required.

8. Breach Notification

Sara will notify the Covered Entity without unreasonable delay following discovery of any Breach of Unsecured PHI, in accordance with 45 C.F.R. §164.410. The Covered Entity is responsible for any required notifications to individuals, regulators, or authorities unless otherwise agreed in writing.

9. Contact Information

Privacy Officer
Sara Technology, Inc.
Email: support@saraspeech.com

B. HIPAA BUSINESS ASSOCIATE AGREEMENT

(Incorporated by Reference)

This Business Associate Agreement ("BAA") is incorporated into and forms part of the Sara Terms of Service for professional users.

By creating an account, clicking acceptance, or using the Sara platform in a professional capacity, you acknowledge and agree that this BAA is legally binding.

1. Definitions

"Covered Entity" means the Speech-Language Pathologist, clinic, school, healthcare organization, or other entity using Sara that qualifies as a Covered Entity under HIPAA.
"Business Associate" means Sara Technology, Inc.
"PHI" has the meaning set forth in 45 C.F.R. §160.103.

2. Obligations of Sara

Sara agrees to:

Use and disclose PHI only as permitted by this BAA, the Terms of Service, and applicable law
Implement reasonable and appropriate safeguards to protect PHI
Report Breaches of Unsecured PHI to the Covered Entity
Ensure that subcontractors agree in writing to HIPAA-compliant obligations
Return or destroy PHI upon termination of services, where feasible, unless retention is required by law

3. Obligations of Covered Entity

The Covered Entity agrees to:

Comply with HIPAA and applicable privacy laws
Obtain and maintain all required patient or parental authorizations
Not request or permit Sara to use PHI in a manner that violates HIPAA
Notify Sara of any restrictions applicable to PHI

4. Term and Termination

This BAA becomes effective upon acceptance of the Terms of Service and remains in effect until all PHI is returned or destroyed, unless retention is legally required or technically infeasible.

5. Survival

All provisions related to confidentiality, security, breach notification, and liability survive termination of this Agreement.

HIPAA Notice of Privacy Practices & Business Associate Agreement